Security update for "PLATYPUS" side-channel attack

Security Nov 17, 2020

Security updates are available for XCP-ng 8.1 and 8.2 RC.

To update, follow this guide. You can also join the discussion on our community forum. Hosts reboot necessary after this update.

Summary

Several security issues have been identified in Intel CPUs as well as in Xen in relation with the first on these hardware issues.

Side-channel attack through exposed power-monitoring interface. As usual with that kind of attack, the researchers gave it a nickname: PLATYPUS (CVE-2020-8694 and CVE-2020-8695). Addressed through a microcode update (and/or your hardware vendor's firmware updates) and a Xen update.
"Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access." (CVE-2020-8696). Addressed through a microcode update (and/or your hardware vendor's firmware updates).
"Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access." (CVE-2020-8698). Addressed through a microcode update (and/or your hardware vendor's firmware updates).

Consequences of PLATYPUS attack

Privileged malicious code running in a guest VM may be able to infer details of some computations running in other VMs of the same host, such as secret encryption keys, for example.

What to do

Apply you hardware vendor security updates, update XCP-ng, reboot your hosts.

XCP-ng 8.0 reached end of support

XCP-ng 8.0 has reached its end of life and will not receive security updates anymore. Upgrade to XCP-ng 8.1 or to the new Long Term Support release, XCP-ng 8.2 (available very soon).